大规模网络服务系统行为异常的敏捷感知方法

摘要

大规模网络服务系统环境中,短时的大规模用户合法行为聚集会造成系统行为异常,使得系统可用性受到极大的损害.现有的系统异常检测方法大多适用于用户非法行为造成的系统异常.文中针对用户合法行为短时聚集引起的系统异常问题,提出一种大规模网络服务系统行为异常敏捷感知的方法.该方法包括系统异常敏捷感知模型和重复行为检测的Petri模型.基于“放大因子”的系统异常敏捷感知模型给出了系统异常的可预知性和异常系统行为的可定位性.即如果系统会在未来的某一时刻t2发生异常,那么t1时刻预期系统负载值要大于系统所能承受的最大负载值(t2＞t1).而且,该模型通过行为阻滞度可确定引起系统异常的系统行为.在敏捷感知模型的基础上,针对应用系统的异常检测,提出了基于带优先关系的颜色双变迁Petri网的重复行为检测模型及其系统异常敏捷感知算法.根据单位时间内用户行为数较小变化、缓慢增长和激增三种情况进行模拟实验,实验结果表明该方法可以有效地在系统异常发生之前提前感知,并能定位引起系统异常的系统行为.%In a large-scale network service system,the instantaneous gathering of a number of legal users can cause abnormality of system behaviors and vastly damage the system availability.Most of the existing methods can detect anomalies caused by illegal user behaviors.To detect those anomalies caused by legal users,this paper presents an agile perception method.This method includes an agile perception model of the system anomaly and a Petri Net model of repetitive behavior detection.The agile perception model based on Magnification Factor can propose the perception of system anomalies and the localizability of abnormal system behaviors.That is,the expectant system load with Magnification Factor at some time t1 exceeds the maximum system load if the system is abnormal at some time t2 (r2 ＞t1) in the future.Furthermore,this model can also confirm the abnormal system behavior by the blocking degree of behaviors.Based on the agile perception model,this paper further presents a Petri Net detection model with priority relation and color double transition.To verify our method,we simulate a ticket booking system.According to the traffic graph of 12306 System,we simulate three change features of legal user behaviors including increasing little,increasing slowly,and increasing sharply in unit time.The experimental results show that our method can effectively perceive a forthcoming system anomaly and locate it before its occurrence.